19

I've encrypted my Dropbox folder with EncFS according to a few tutorials I found on the web, advocating this approach.

But I've found the following critical statement concerning EncFS's security in this security-audit:

EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the opportunity to see two or more snapshots of the ciphertext at different times. EncFS attempts to protect files from malicious modification, but there are serious problems with this feature.

So, as long as they only get one copy of the encrypted files it's fine, but if they get more, it might be dangerous.

Well, when using Dropbox, they would get a hell lot of different snapshots of the encrypted files (since they will be synchronized after every change).

Thus EncFS would be not a secure solution in combination with a cloud-service à la Dropbox, right?

9

EncFS is missing a certain set of safeguards, but it's perfectly safe if you don't use it in such a way that requires protections that it doesn't provide.

In particular, EncFS leaks all sorts of metadata: times, sizes, name lengths, filesystem structure, update patterns and more. It also doesn't offer tons of protection if the attacker can control what data gets encrypted.

But assuming all you need to do is keep your file contents safe from a passive observer with read-only access (particularly as a single point-in-time snapshot) to the underlying drive data, EncFS can provide this protection just fine. Since this really is the typical use case, EncFS is a pretty reasonable safeguard.

If what you need is more serious protection then that, then you probably want to use a loopback-mounted disk image file which you can encrypt with tools like LUKS, or your favorite FDE utility.

  • This is really confusing. The accepted answer says that it is completely fine for protecting file contents, but the answers below state that an attacker could gain access to the contents in certain scenarios. – Maciej Krawczyk Sep 21 '17 at 9:55
  • @MaciejKrawczyk it depends on what you care about. If you're worried about an attacker finding out the number or size of files, or finding out which files you change, then encfs doesn't do it for you. If knowing that information puts you at risk, then don't use it. Contents aren't directly determinable, but could be inferred if you know more about how the data is used. Mostly it's fine for lite low-intensity use but not recommended for large scale operations. – tylerl Oct 14 '17 at 20:34
  • @tylerl "particularly as a single point-in-time snapshot [...] Since this really is the typical use case, EncFS is a pretty reasonable safeguard" I don't get it: That's not the typical use case since Dropbox automatically stores multiple versions of the same file! An attacker will have access to those, too. That's the security risk described by the audit. EncFS doesn't only leak folder structure, but is vulnerable to attacks if used on Dropbox. Did I misunderstand your answer? In any case, please edit your answer to clarify. :) – finefoot Jun 13 at 11:21
10

As tylerl and user80945 already said, using EncFS in a Dropbox is not secure. More information can be found in this article.

An alternative would be CryFS. It is a new open source project that doesn't have the security vulnerabilities of EncFS, and also encrypts the metadata (e.g. file sizes and directory structure).

Disclaimer: I'm one of the developers of CryFS. We were using EncFS in a Dropbox ourselves and developed an alternative because of the mentioned shortcomings.

  • 1
    In the article about EncFS it says "EncFS is not secure when an attacker gets multiple versions of the same encrypted file at different times. So if you upload your files to your Dropbox and then modify them, they are not securely encrypted anymore." Wouldn't the edited file no longer be the same file? – PKKid Apr 26 '16 at 21:20
  • 1
    It basically means you're screwed if you modify the file back to its original state sometime later (say you added a line in the end and then decided to remove it again). If you never modify it back, you might be safe, although the plaintexts are probably still highly correlated and I wouldn't vouch for security. – Heinzi Apr 28 '16 at 17:40
  • I'm actually not sure what EncFS does when you rename a file. If they reencrypt it, an attacker would get a second ciphertext of the same plaintext. – Heinzi May 3 '16 at 18:58
  • I'd give CryFS a try though as of 2018 the web site still says there is no stable version yet – oᴉɹǝɥɔ Feb 20 '18 at 14:53
5

If I understand the security audit report correctly, one should not use encfs for encrypting Dropbox: Dropbox saves several versions of all files and this can be exploited for an attack.

Anyone having access to your Dropbox account has access to these different versions. I do not know how many versions an attacker would need and I am by no means an expert on this subject, hence I cannot judge the impact of this.

  • Welcome to Information Security Stack Exchange! I took the liberty of removing the last part of your answer, as that does not add to the actual answer. If you disagree with my edit, you can roll it back - click on the "edited ... ago" link to go to the edit history, where you have the rollback option. Meanwhile, enjoy your stay! – S.L. Barth Jul 14 '15 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.